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■ Abstract 
(N ■ 

In this note, we characterize the form of an invertible quantum operation, i.e., a completely positive 

■ trace preserving linear transformation (a CPTP map) whose inverse is also a CPTP map. The precise 
^ \ form of such maps becomes important in contexts such as self-testing and encryption. We show that 

these maps correspond to applying a unitary transformation to the state along with an ancilla initialized 
to a fixed state, which may be mixed. 

The characterization of invertible quantum operations implies that one-way schemes for encrypting 
quantum states using a classical key may be slightly more general than the "private quantum channels" 
studied by Ambainis, Mosca, Tapp and de Wolf [TJ Section 3]. Nonetheless, we show that their results, 
most notably a lower bound of 2n bits of key to encrypt n quantum bits, extend in a straightforward 

■ manner to the general case. 

-i— > ■ 
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The most general physically allowed operation on a quantum state consists of coupling it to another system 
(an ancilla) in a known state, via a unitary transformation, and then discarding part of the system. (In 
this article, a quantum state may be mixed and is modeled by a density matrix.) We say that a quantum 
operation E is invertible, if there is another quantum operation D such that DE{p) = p for every state p 
in the domain of E. Mathematically, a quantum operation corresponds to a completely positive trace 
preserving linear transformation, a CPTP map [U Section 8.2]. A CPTP map may be an invertible linear 
transformation, but may not correspond to an invertible quantum operation in the sense defined above. 
For example, the depolarizing channel is an invertible CPTP map, but its inverse is not even positive. 
However, if a CPTP map corresponds to an invertible quantum operation, it is necessarily also injective, 
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and therefore invertible on its image. This is because there is a basis for the domain consisting of density 
matrices alone. 

In this note, we characterize the form of an invertible quantum operation. The precise form of such maps 
becomes important in contexts such as self-testing [11] and encryption [lj. A unitary operation is a natural 
example of a CPTP map that is also invertible. It seems intuitively obvious that all invertible quantum 
operations also be unitary. This is indeed the case for CPTP maps transforming a Hilbert space into 
itself f9l Chapter 3, Section 8, Exercise 3.2]. Here, we examine the more general case, where an invertible 
quantum operation may take d-dimensional states to states in a Hilbert space of possibly larger dimension. 
We show that these maps correspond to applying a unitary transformation to the state along with an ancilla 
initialized to a fixed state, which may be mixed (Theorem 12 . X [> . We also extend this characterization to 
completely positive (CP) maps in Theorem 12.21 Its significance lies in the fact that when suitably scaled 
by a positive real number, CP maps correspond to the result of getting one of a subset of outcomes on a 
measurement. 

Invertible quantum operations also occur in the context of error correction. There, the goal is to find a 
linear subspace of a Hilbert space such that the restriction of the noise operator to this space is invertible. 
The proof of our characterization theorem closely follows the proof of the error-correction criterion [8j 
page 436, Theorem 10.1]. 

A notion related to error-correction is that of a reversible quantum operation. Several authors [HE] consider 
operations that are completely positive maps defined by the process of making a measurement, and getting 
one of a subset of outcomes. They call such an operation E reversible on a subspace, if for all states p in the 
subspace, there is a quantum operation D such that D(E(p))/Tr(E(p)) = p. Nielsen et al. [7] characterize 
such operations in information theoretic as well as algebraic terms (akin to the error-correction criterion). 

Theorem 12.11 has implications for perfect encryption of quantum states using a classical private key (see, 
e.g., Ref. [T]). These protocols for encryption, also called "private quantum channels" by some authors, 
involve two parties, labeled Alice and Bob. The two parties share a secret, uniformly random bit-string k, 
called the private key. Alice wishes to send a quantum message, a d-dimensional quantum state p, to 
Bob. She would like to apply an invertible CPTP map E^ to the state, and send it to Bob so that when 
averaged over k, the result is a fixed density matrix (independent of the message). This would ensure that 
no eavesdropper be able to distinguish two different messages with any degree of success, and therefore 
guarantee information theoretic security. Bob, who also has the key k, can apply the inverse operation 
to decrypt the message p perfectly. (We have implicitly assumed that the quantum channel is noiseless 
unless an eavesdropper tampers with it.) 

The characterization of invertible quantum operations implies that in the most general one-way encryption 
scheme, Alice may apply a unitary operation to the state to be encrypted along with an ancilla that depends 
upon the key. This is slightly more general than the form studied by Ambainis, Mosca, Tapp and de Wolf [TJ 
Section 3], where the ancilla is assumed to be independent of the key. Nonetheless, their results, most 
notably a lower bound of 2n bits of key to encrypt n quantum bits, extend in a straightforward manner to 
the general case. We summarize these observations in Section O 

The lower bound of In classical key bits needed to encrypt quantum states was also shown by Boykin and 
Roychowdhury [2], assuming that no ancilla is used. Their proof was simplified by Ambainis et al. pQ. 
Since the addition of ancilla results in longer ciphertext, and hence is less efficient, this case is of special 
interest. We observe that this 2n lower bound follows directly from a "rank argument". 

We point out that information theoretic proofs due to DiVincenzo, Hayden, and Terhal [3l Section IV] 
and Jain [2] follow a different route to the same lower bound on the length of key for general one-way 
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encryption schemes. We also note that the requirement of perfect information theoretic security imposes 
an additional constraint on the maps E\~, apart from invertibility. This constraint may simplify the math- 
ematical structure of these schemes, and further simplify the proofs we give. 

2 Invertible quantum operations 

We refer the reader to the text [8] for basic concepts related to quantum states and operations, and present 
our characterization theorem directly. 

Let L(W) denote the set of linear operators on the Hilbert space 7i. 

Theorem 2.1 Let E : L(C P ) — > L(C 9 ) be a completely positive, trace preserving linear transformation (a 
CPTP map). Suppose there is a CPTP map D : L(C <? ) — ► L(C P ) such that DE{p) = p for all density 
matrices p G L(C P ). I.e., E is an invertible quantum operation with inverse D. 

Then there is a density matrix uj G L(C!- 9 / p J), and a unitary operation on C q such that E(p) = U{p(&oj)U^ . 
Furthermore, D corresponds to applying U\ and tracing out the [q/p\ dimensional ancilla. 

Proof: As mentioned in Section [H there is a close analogy between error-correction, and the invertibility 
of quantum operations. If we view C p as a code subspace, and E as a noisy channel restricted to this 
subspace, then the decoding map D corrects any "errors" introduced by E. We may thus appeal to the 
error-correction criterion [8, page 436, Theorem 10.1] to give a short proof of the theorem. Instead, in 
the interest of completeness, we present the details below. Those familiar with the criterion may skip to 
Equation ([2]) and then to Equation (|3|) after picking up the notation in the next paragraph. 

A CPTP map from L(C n ) to L(C m ) can be expressed in terms of linear transformations from C n to C m 
(Kraus operators), using an operator sum representation Exercise 8.3]. Suppose we express both maps E 
and D in terms of some set of Kraus operators {Ai} i€l and {Bj}.^j, respectively. Then, by the invertibility 
of E, we have, for every p G L(C P ) 

de(p) = j2J2 B ^p A t B } = p- 

iex jej 

Thus, the CPTP operation DE defined on L(C P ) may equivalently be expressed in terms of the single 
Kraus operator I p , the identity operator on C p . By the unitary equivalence of Kraus representations [HI 
Page 372, Theorem 8.2], there are complex numbers otij, such that Yliei ^jej \ a ji\ 2 = ^> anc ^ f° r an * e 

3 € J, 

BjAi = aji Ip . 

Therefore for all i, i! G T, 
where 

A'i = /I aji'Uji- (1) 
jej 
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Observe that M = (A'i)i',iei i s a Hermitian matrix. Since, ^j^j BjBj = I q , we have for all G I, 

A\,Ai = fcilp. (2) 

The conditions in Equation ([2]) imply that each Kraus operator Aj is a scaled isometric embedding of C p 
into C 9 . However, the resulting images need not be mutually orthogonal. We therefore first derive an 
equivalent representation for E in which the Kraus operators embed into orthogonal subspaces. 

Using equation (pQ) above, we have that for any vector x G C 1 , 

(x ] Mx) = x v fiin Xi 

i,i'£l 

= E ( X^' )wZ Xi a a 

jej Vi'ex / Viex / 

> 0. 

So the matrix M is positive semi-definite. Moreover 



Tr(M) = J> = EE 



J 1 



iei i€i jej 



Let V = (vi'i)i' : i(zj be a unitary matrix that diagonalizes M. Let T = V^MV be the resulting diagonal 
matrix, with 73 = Ta > for all i £ 1, and Xliex7* = SiexA* = Then the Kraus operators Ck = 
^ Vik Ai, k £ I also represent the same map E, as may be checked by direct substitution (cf. [8, Page 372, 
Theorem 8.2]). Moreover, the range spaces of the various operators Ck are orthogonal. In fact for k, k' G X, 



E Vi ' k ' A l) X Vik Ai 
\i'ei J Kiel J 

Vi'k' Vik [A\' A i 
Vi'k' V ik {Pi' ilp, 



iei 



y] v^k' Pi'i Vik 1 • ip 



— L fc ' fc I p 

= 5k'k Ik Ip, (3) 

where 5 is the Kronecker delta function. 

Define /C = {fc G T : 7^ 7^ 0}. Looking at the singular value decomposition of Ck, fc G JC, we now conclude 
that all its singular values are equal to ^/yk, and that the various operators Ck are scaled unitary embeddings 

of C p into orthogonal subspaces of C q : Ck = ^Jk J2ie[p] \ykl)( u \ k ^ |> where {yjy}fc 6 x; j 6 [p] is an orthonormal 
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set of vectors in C g , and {^P'*} is an orthonormal basis of C p for each k £ IC. As a consequence, q > p, 
and |/C| < [q/p\ ■ 

We may now define u = Ylk&K \wk){wk\, where {wk} k£ ^ is an orthonormal set in C^/P-l. Define U as 
any unitary extension to C q of the map: 

K )®|wfc) ^ |2/fcZ> , 

where k £ JC and i £ [p]. A straightforward check confirms that E may be implemented by applying U 
to any state in C tensored with ancilla u. Similarly, the inverse operation D may be implemented by 
applying W and tracing out the state u. ■ 

The proof of the invertibility criterion tells us how to deal with the subtlety that the ancillary density 
matrix lo may be expressed as a multitude of mixtures, each of which gives rise to a different Kraus 
representation for the map E. For an arbitrary mixture Y2t r t\ ( t ) t){ ( t ) t\ = the resulting Kraus opera- 
tors Et = ^/¥tU(I p (g) \4>t)) are n °t necessarily in the form from which the operator U is evident. The 
diagonalization of the matrix M in the proof corresponds exactly to the diagonalization of to and this 
allows us to "read out" the unitary matrix, and the ancilla state lo itself. 

The converse of our theorem is manifestly true, so it provides a characterization of invertible quantum 
operations. An alternative characterization was pointed out to us by Jon Tyson |10j . Below, we state an 
extension of his characterization to completely positive (CP) but not necessarily trace preserving maps, 
and sketch its proof. 

Theorem 2.2 A completely positive (CP) linear transformation E : L(C P ) — * L(C 9 ) has a CP inverse D 
iff there exists a positive semi- definite linear operator Q E L(C 9 ) and a real number c > such that for all 
density matrices p,a £ L(C P ) ; 

Tv(QE(p)QE(a)) = c-Tr(pa). 

In addition, a CPTP map E has a CPTP inverse D iff Q may be taken to be the identity operator I q in 
the above characterization. 

Proof: We first sketch a proof of the forward direction of the theorem. Suppose we have a CP map E 
with a CP inverse D. Express E and D in terms of some set of Kraus operators {Ai}^ and {Bj} .^j, 
respectively. Arguing as in the proof of Equation ([2]) of Theorem 12.11 we have for all i, i' G X, 

A\,QAi = A'iV (4) 

where Q = B^Bj and fyi is as in Equation (UJ). Note that Q is positive semi-definite. From 

Equation (g]), it follows that Tr(Q E(p) Q E(a)) = c-Tr(pa), where c = E^'ex l/M 2 - Note that c > 
since Yliei Pa = 1 as in the proof of Theorem 12. 1L 

We now sketch a proof of the reverse direction of the theorem. The condition Tr(Q E(p) Q E(a)) = c-Ti(pa) , 
with Q positive semi-definite and c > implies that 

cTt{pa) = Tr(QE(p)QE(a)) = Tr QA iP A^A V GJ$ v 



Tr [ p Y A\QAyaA\,QAi \ , 

i,i'el 
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for all density matrices p, a. This means that j'ej A^QAiiaA^QAi = ca for all density matrices a, since 

density matrices p form a basis for L(C P ). This implies that the CPTP map defined by |c _1 / 2 A|(5^4j'| 

is the identity map on L(C P ). By the unitary equivalence of Kraus operators, we see that there are 
complex numbers Yin 1 IA,«'| 2 = c such that A^QA^i = fyj'Ip, for all G I. Taking trace, 

we have = p~ 1 TrA\QAi' . The matrix M = (A^Om'sz is Hermitian, and by arguing as in the proof 
of Theorem 12.11 we see that M is positive semi-definite. Let E' denote the CP map given by the Kraus 
operators {Q 1 ' 2 ^}.^. Now we follow the proof of Theorem 12.11 from the argument for Equation (|3|) 
onwards to conclude that there exists a positive semi-definite matrix uj G ~L(C^ P ^), and a unitary operation 
U on C q such that E'(p) = U(p ® lu)W for all density matrices p in L(C P ). This shows that E has a CP 
inverse D which corresponds to conjugating by U^Q 1 ^ 2 , and tracing out the [q/p\ -dimensional ancilla uj. 

Suppose now that CPTP map E has a CPTP inverse D. In the above argument, we get Q = YljeJ j^j = 
I q . Conversely, suppose that CPTP map E satisfies Tr(E(p)E(a)) = c-Ti(pa), c > for all density matrices 
p,o~ G L(C P ). The trace preserving property of E implies that the matrix M in the above argument has 
unit trace. This implies that the positive semi-definite matrix ui has unit trace, that is, uj is a density 
matrix. This shows that E has a CPTP inverse D which corresponds to applying U\ and tracing out 
the [q/p\ -dimensional ancilla uj. ■ 



3 Perfect encryption of quantum states 

A one-way protocol for perfect encryption of quantum states in L(C rf ) consists of a probability distri- 
bution {pk,Ek} over invertible quantum operations E^ : L(C d ) — > L(C D ) such that the image of every 
state p G L(C d ) under the map 

R{p) = Y.p* E ^p) 

k 

is a fixed state a G L(C D ). This is also known as a randomization scheme, or a private quantum channel. 

As mentioned in Section [H the probability distribution {pk} corresponds to a random secret key that two 
parties Alice and Bob share. The map E^ is an encryption map that Alice applies to her quantum message p, 
and its inverse is the decryption map that Bob applies to retrieve the message. To an eavesdropper with 
no information about the secret key, the density matrix of the ciphertext is exactly a = R(p). Since this 
is completely independent of the message, the protocol achieves information theoretic security. 

Our characterization theorem from the previous section implies that the most general one-way quantum 
encryption scheme R (with no decoding error in the absence of eavesdropping) is of the following form: 
for each value of key k, there is an ancilla cj^, possibly mixed, and a unitary Uk such that E(p) = 
TlkPk ^k{p® LjJ k)U\. This is slightly more general than the form assumed by Ambainis, Mosca, Tapp, and 
de Wolf pQ Section 3], in that the ancilla may depend on the value of the key. However, their results, 
especially a proof that 2n bits of key are required to encrypt n quantum bits, extend to this form of 
encryption in a straightforward manner. Below we give a sketch of this extension. 

We begin with the following the lemma. 

Lemma 3.1 Let {pk,Ek} define a perfect encryption map R for d-dimensional quantum states in L(C d ). 
Then, for any two orthogonal states \i), \j) G L(C rf ), R(\i)(j\) = 0. 
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A simple proof of this lemma occurs in Theorem 5.2 of Ref. [5] , and works verbatim for an encryption scheme 
as described above. We need only consider the action of R on the states \ j), t^(K) + 7^(K) + 

where i = to arrive at the lemma. (A stronger version of this lemma occurs as Lemma 4.4 in Ref. [lj 

and also generalizes verbatim.) 

An immediate corollary of Lemma 13. II is that if one half of a bipartite Bell state is encrypted, the resulting 
bipartite state is independent of which Bell state was encrypted. In fact, if the encryption procedure is 
applied to the first half of the any input Bell state, the resulting state is proportional to a ® I where a 
the output state of the encryption procedure. Using this property, Ambainis et al. Q] show that any 
protocol to encrypt n quantum bits may be transformed to a protocol that encrypts 2n classical bits. 

Lemma 3.2 Let {p k ,E k } define a perfect encryption map R for n qubit states. Then, there is a map R' 
given by a distribution {p k ,E k } that perfectly encrypts 2n classical bits (i.e., a fixed basis of C 2 ). 

The idea behind this lemma is to encode the 2n bits into orthogonal Bell states over 2n qubits, then encrypt 
one half of the Bell state using R and finally send the bipartite state across as the encrypted message. The 
map R' is given by the composition of these steps. 

Finally, we show how to extend Theorem 5.3 of Refs. Q]. The proof relies on concepts from quantum 
information theory. We refer the reader to the two papers, and the text [8] for the required background. 

Lemma 3.3 Let {p k ,E k } define a perfect encryption map R for m classical bits. Then, the Shannon 
entropy H(p) of the distribution p is at least m. 

Proof: Consider a, the result of encrypting the basis state |0)(0|. Then, i?(|0)(0|) = a = R(I/2 m ), since 
the completely mixed state may be viewed as a mixture of (classical) basis states. So 

a = £p fc £7 fc (|0X0|) 
k 

k 

= Y. pkUk u l 

Invoking Theorem 11.10 on page 518 of Ref. [8], the von Neumann entropy of a may be bounded above as 

S(cr) = 5^p fc £7 fc (|OXO|)J 

< H(p) + J2PkS(E k (\0)(0\)) 

k 

= H{p) + Y,Vk S(U k (\0)(0\ u k )Ul) 

k 

= H(p) + ^Pk S(u k ). 

k 
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By concavity of von Neumann entropy, S(a) may also be bounded from below as 



= ^ft W m ) + %)) 

+ E Pfc S(b>k). 



k 
m 



The two bounds together give H(p) > m. ■ 
Lemmas 13.21 and 13.31 imply: 

Theorem 3.4 Let {pk,E k } define a perfect encryption map R for n qubits. Then, the Shannon en- 
tropy H(p) of the distribution p is at least 2n. 

A weaker version of this theorem, where the encryption operations E k are chosen to be unitary, was shown 
by Boykin and Roychowdhury [2]. We sketch how in this case, a lower bound of 2n bits for the size of key 
follows from a simple rank argument. 

Let {pk, Uk} define a perfect encryption map R for n qubits for some unitary operators U^. Note that R 
is a unital map; it maps the completely mixed state to itself. Therefore, the output state of R is the 
completely mixed state a = ^p-. For any bipartite pure state p on 2n qubits, the rank of (I<8>i?)p, where R 
acts on one half of p, is at most the number of non-zero p&. However, from the corollary to Lemma 13.11 
mentioned above, if we choose p to be any pure bipartite Bell state, one half of which is encrypted, 

(I®R)p = — ®a 



2 n 2 2n ' 

which has rank 2 2n . Thus, the support of the probability distribution of the secret key has size at least 2 2n , 
which gives the claimed lower bound. Note that this does not imply the stronger claim of Theorem 13.4 
that the entropy of the distribution is 2n, or the stronger characterization of optimal perfect encryption 
schemes (without ancilla) due to Boykin and Roychowdhury [21 Section III]. 
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